This vulnerability involves the initialization of a resource with an insecure default in the SD-330AC device and AMC Manager from silex technology, Inc. Specifically, when the device is connected to a network with its factory-default settings, it can be configured using a null string password, effectively allowing unauthorized configuration changes. The affected versions are 1.42 and earlier. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An attacker can connect to the affected device on the network and configure it without authentication due to the null string password default. This leads to a high integrity impact, meaning unauthorized changes to device configuration are possible. There is no direct confidentiality or availability impact reported. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid deploying devices with factory-default configurations on untrusted networks or immediately change default credentials upon initial setup to mitigate risk.